Spammer hosting located here:
https://uyxsq.s3.amazonaws.com/X
-> https://www.nusmall.com/X
—> https://tracking.affid21221il.com/aff_c?offer_id=X
—> http://de.thebitcoinscode.com/?TrackingID=X
$ dig +short de.thebitcoinscode.com
172.67.192.94
104.28.30.134
104.28.31.134